Account-Opening Document Checks Under SFC Guidance

Opening a securities account is a control point for identity fraud, money laundering, and misuse of a brokerage relationship. In May 2026, the SFC described deficiencies found in reviews of licensed brokers, including acceptance of questionable or forged client documents and inadequate ongoing monitoring of cross-border correspondent relationships.

Verify the documents, not just the file checklist

A complete-looking onboarding file can still contain unreliable evidence. Staff should examine whether documents come from a credible source, whether names, addresses, dates, and account information align, and whether alterations or inconsistent details need clarification. An unexplained discrepancy is a reason to investigate and escalate, not to treat the checklist as satisfied because a document was uploaded.

Escalate red flags and understand the relationship

The firm should understand the client’s purpose, beneficial owners, authorized persons, source of funds, and expected activity under its risk-based procedures. If a client’s explanation or documents do not make sense, staff should seek clarification, apply enhanced due diligence where warranted, and consider whether to decline or restrict the relationship. Cross-border correspondent relationships require due diligence before onboarding and ongoing monitoring for unusual flows or control failures.

Senior management and evidence

The SFC places ultimate responsibility on senior management for standards of conduct and robust internal controls. The firm should retain evidence of document verification, discrepancies, decisions, approvals, and ongoing reviews. Controls should be risk-based and proportionate, but a small firm still needs to show how it prevents forged documents from being accepted and how it follows up on warning signs.

Exam checklist

• Check authenticity and consistency, not just whether a document is present.
• Resolve inconsistencies and record the evidence reviewed.
• Escalate suspicious or unexplained information through the AML process.
• Apply due diligence to cross-border correspondent relationships and monitor them over time.
• Keep senior management accountable for design and operation of the controls.

The 2026 SFC expectations

The SFC’s 2026 circular on account opening and maintaining client relationships expresses zero tolerance for questionable or forged documents used in onboarding or ongoing relationships. Firms should verify documents are genuine, complete and consistent, investigate red flags, and avoid treating a checklist as a substitute for due diligence. The circular also highlights risks in maintaining dormant or unusual accounts and in failing to refresh client information.

Verify source and integrity

Check whether the document came from a reliable source, matches the client and entity named, contains consistent identifiers and has signs of alteration. For electronic submissions, assess metadata and verification methods proportionate to risk; for paper copies, verify certification and contact the issuing institution through independently sourced contact details. Do not use a phone number or link printed on a suspicious document as the sole verification route.

Look for inconsistencies across the relationship

Compare the account form, identity documents, address, beneficial ownership, source of funds, bank account, transaction purpose and expected activity. A mismatch does not always prove fraud, but it requires a documented explanation. Unrelated clients sharing an address or bank account, frequent account-detail changes, inactive accounts used only to receive funds, or profiles inconsistent with an intermediary’s jurisdiction may warrant enhanced review.

Beneficial ownership and authority

Identify who ultimately owns or controls a legal-person client and who is authorized to act. Obtain appropriate corporate documents, resolutions and authority evidence, then verify that they are current. A signatory’s authority to transact is different from beneficial ownership. A nominee or intermediary relationship may require additional information to understand the customer and the expected activity.

Escalate rather than waive the red flag

If a document appears forged or questionable, stop onboarding or restrict the relevant activity while the issue is investigated, consistent with the firm’s obligations and client risk. Escalate to compliance and senior management, obtain independent confirmation, and consider suspicious-transaction reporting if the facts create a suspicion of crime. Do not allow sales pressure to override verification.

Ongoing relationship monitoring

Account opening is not the end of due diligence. Refresh records when contact details, ownership, activity, risk or transaction behavior changes. Investigate activity inconsistent with the profile and ensure the account is not being used as a pass-through or depository. A relationship review should update both client records and expected activity used by transaction monitoring.

Record the reasoning

Maintain the source documents, verification steps, identified inconsistencies, client explanations, approvals, risk rating and decision. If the firm declines or restricts an account, preserve the factual basis and any escalation. A good record lets a reviewer see that the firm investigated the issue rather than simply documenting that an employee checked a box.

Exam method

State the SFC expectation to verify authenticity, completeness and consistency; apply the red flags; escalate and investigate; assess ongoing activity; and preserve evidence. Distinguish a document discrepancy from a confirmed forgery, but do not ignore either. Apply proportionate controls while protecting against onboarding a fictitious or misused account.

Non-face-to-face verification

Remote onboarding can use approved electronic identity tools, liveness checks, independent data sources and secure document capture, but the control must fit the client risk and current rules. A clear image is not proof that a document is genuine. Escalate failed verification, inconsistent identity data or signs that a third party controls the account.

Do not let account maintenance bypass onboarding controls

Requests to change a phone number, email, address, bank account or beneficial owner can be used to take over an existing account. Verify the request independently and apply dual approval to high-risk changes. Reassess whether the change alters the client risk profile or expected activity, and monitor transactions immediately afterward.

When to decline or restrict

If authenticity cannot be established or the client’s explanation does not resolve a material inconsistency, the firm should not proceed as if onboarding were complete. Escalate to compliance and apply a proportionate restriction or decline. Where suspicion of money laundering or crime arises, use the firm’s confidential escalation and reporting procedures without tipping off the client.

Key takeaway

Account opening is a continuing due-diligence process. Verify evidence, investigate red flags, understand the relationship, and document decisions from onboarding through monitoring.